FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in av_dynamic_hdr_plus_to_t35() that leaves up to three payload bytes… (CVE-2026-107676)

The vulnerability in FFmpeg (up to version 9.0.2) involves uninitialized memory disclosure in the av_dynamic_hdr_plus_to_t35() function. Specifically, when tone_mapping_flag is 0, up to three bytes of payload remain uninitialized. Crafted metadata in Matroska T.35 BlockAdditional or HEVC/AV1 SEI can trigger this condition during remuxing or transcoding, resulting in leakage of process memory into output files. This is classified under CWE-908 (Use of Uninitialized Resource).

An attacker can cause FFmpeg to leak small amounts of uninitialized process memory into output files during remuxing or transcoding of specially crafted media files. This could potentially expose sensitive information contained in process memory. The impact is limited to confidentiality with no integrity or availability effects. The CVSS score of 3.3 reflects a low complexity local attack requiring user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid processing untrusted media files that may contain crafted Matroska T.35 BlockAdditional or HEVC/AV1 SEI metadata. Monitor vendor channels for updates and apply official patches once released.